geocities spam, why isn't it caught

[Remy de Ruysscher]

    [ The following text is in the "ISO-8859-1" character set. ]
    [ Your display is set for the "US-ASCII" character set.  ]
    [ Some characters may be displayed incorrectly. ]

Remco Barendse wrote:

> Hi!
>
> I know this item was dicussed on the list before but I seen an 
> increasing number of geocities spam mails.
>
> They aren't using only uk.geocities.com but also geocities.com and 
> it.geocities.com but I guess they could come up with a 1,000,000 of 
> variants.
>
> The mails are only scored by bayes, none of the other checks are 
> triggered. I knos someone posted a rule to block uk.geocities.com 
> (even though I lost the mail) but what worries me more is the fact 
> that they manage to get past all checks incl. SURBL / URI and dcc checks.
>
> Anyone have any idea why, is my setup wrong?
>
> Thanks!
> Remco
>
> ------------------------ MailScanner list ------------------------
> To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
> 'leave mailscanner' in the body of the email.
> Before posting, read the Wiki (http://wiki.mailscanner.info/) and
> the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).
>
> Support MailScanner development - buy the book off the website!
>
>
This works perfectly.

Just add a prolo.cf to you spamassassin directory with this content:

uri PROLO_PUBWEB_UKGEO_CHECK1 /^http:\/\/uk\.geocities\.com\//
uri PROLO_PUBWEB_UKGEO_CHECK2 /^http:\/\/www\.geocities\.com\//
score PROLO_PUBWEB_UKGEO_CHECK1  4.0
score PROLO_PUBWEB_UKGEO_CHECK2  4.0
describe PROLO_PUBWEB_UKGEO_CHECK1 PROLO_PUBWEB_UKGEO_CHECK1, Body
describe PROLO_PUBWEB_UKGEO_CHECK2 PROLO_PUBWEB_UKGEO_CHECK2, Body

(Orginally posted by Raymond Dijkxhoorn).

------------------------ MailScanner list ------------------------
To unsubscribe, email jiscmail at jiscmail.ac.uk with the words:
'leave mailscanner' in the body of the email.
Before posting, read the Wiki (http://wiki.mailscanner.info/) and
the archives (http://www.jiscmail.ac.uk/lists/mailscanner.html).

Support MailScanner development - buy the book off the website!